CVE-2026-85638
HighCVSS 7.3Summary
jofpin trape 2.0 has a weakness in the file core/user.py where manipulation of the argument vId/id causes authorization bypass. Remote exploitation is possible. The exploit has been made public and could be used for attacks. The project was informed but has not responded yet.
Risk Assessment
An attacker can bypass authorization mechanisms and gain unauthorized access to functions or data, potentially leading to confidentiality or integrity compromise.
Recommendation
Monitor for patches from the project and apply updates as soon as available. Temporarily restrict access to the application.
Other vulnerabilities in jofpin trape
See all- CVE-2026-85637Medium
In jofpin trape 1.0.0/2.0, the join_room function in core/sockets.py of the Admin Endpoint component lacks authentication. The attack can be launched remotely, and the exploit is publicly available. The project was informed but has not responded.
- CVE-2026-85636Medium
In jofpin trape 1.0.0, the core/stats.py file of the Login Endpoint component has a missing authentication vulnerability. The attack can be initiated remotely, and the exploit is publicly available. The project was informed but has not responded.
Original NVD description (English source)
A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.